HAZOP (Hazard and Operability Study) in ISO 26262
HAZOP forces you to think in deviations, not just failures. By applying a disciplined set of guide words to each design intention, this method systematically surfaces the hazards a checklist would never find and feeds them straight into the ISO 26262 hazard analysis and risk assessment.
- Chapters
- 14
- Chapters
- Guide Words
- 11
- Guide Words
- HAZOP Phases
- 4
- HAZOP Phases
- Worked Examples
- 2
- Worked Examples
Quick answers
- What is a HAZOP study in ISO 26262?
- A HAZOP (Hazard and Operability Study) is a structured, team-based analysis that finds hazards by thinking in deviations rather than failures. Standardized in IEC 61882, it anchors on a stated design intention and applies a disciplined set of guide words - NO, MORE, LESS, REVERSE, EARLY, LATE, and others - to each parameter, generating candidate deviations that a checklist would never surface. In ISO 26262 practice, HAZOP is one of the strongest front ends for the hazard analysis and risk assessment: each credible deviation becomes a candidate hazardous event, feeding the safety goals and ASIL assignments of Part 3 with a traceable reason to exist.
- How does HAZOP feed into the ISO 26262 HARA?
- Each worksheet row records a deviation with its causes, consequences, and existing safeguards. Deviations with vehicle-level consequences become hazardous events in the HARA, where they are combined with operating situations and rated for severity, exposure, and controllability to assign an ASIL and derive a safety goal. The traceability runs both ways: every safety goal can point back to the deviation that justified it, and every examined deviation is documented even when it was judged benign - which is exactly the completeness evidence an assessor asks for.
Why it pays for itself
Find hazards checklists miss
HAZOP challenges every stated design intention with guide words, surfacing deviation and interaction hazards that failure-first methods and checklists systematically overlook - then feeds them straight into the HARA.
Run a disciplined four-phase study
Move from definition and preparation through a facilitated examination session to documentation and follow-up, with a worksheet row recording causes, consequences, safeguards, and recommendations for every deviation examined.
Extend guide words to software
Apply the method to signals, CAN messages, and data - frozen, stale, corrupted, and out-of-order values - so software behaviour is examined as rigorously as physical flow.
What you’ll be able to do
Think in deviations, not failures
Anchor every analysis on a design intention and use guide words to systematically negate and distort it.
Apply the eleven guide words
Generate value, functional, timing, and sequence deviations for any parameter or signal.
Run a four-phase HAZOP study
Move from definition and preparation through a facilitated examination to documented follow-up.
Extend HAZOP to software and data
Examine signals, messages, and data for frozen, stale, corrupted, and out-of-order deviations.
Feed findings into the HARA
Turn deviations into hazardous events, safety goals, and defensible ASIL assignments.
Facilitate a rigorous session
Avoid checklist shortcuts and keep the team imaginative, thorough, and traceable to close-out.
Chapter by chapter
- 01
Why HAZOP - Thinking in Deviations
Why disciplined deviation thinking finds hazards that failure-first methods and checklists systematically miss.
- Deviation from intention versus component failure
- The imagination gap a checklist cannot close
- Where HAZOP fits among safety analysis techniques
- 02
Origins & Philosophy - Intention vs Deviation
How a process-industry technique became a structured way to challenge every stated design intention.
- Design intention as the anchor of the study
- Deviation as intention negated or distorted
- Team-based, imagination-driven examination
- 03
Guide Words - The Engine of HAZOP
The eleven guide words (NO, MORE, LESS, AS WELL AS, PART OF, REVERSE, OTHER THAN, EARLY, LATE, BEFORE, AFTER) that turn a parameter into a deviation.
- Applying guide words to each parameter
- Value, functional, timing, and sequence deviations
- Guide word plus element equals a candidate hazard
- 04
HAZOP Inside ISO 26262
How HAZOP findings feed the hazard analysis and risk assessment, driving safety goals and ASIL assignment.
- From deviation to hazardous event
- Feeding item definition and operating scenarios
- Every safety goal traceable to a reason to exist
- 05
The HAZOP Worksheet
The standard worksheet that records element, guide word, deviation, causes, consequences, safeguards, and recommendations.
- A traceable row for every deviation examined
- Distinguishing existing safeguards from actions
- Recommendations that become follow-up items
- 06
The Four Phases
The full study lifecycle of definition, preparation, examination, and documentation with follow-up.
- Definition and preparation before any session
- The disciplined examination session itself
- Documentation, follow-up, and close-out
- 07
Definition & Preparation
Scoping the study, choosing nodes and parameters, and assembling the design intention before the team meets.
- Node and boundary selection
- Parameters and design representations needed
- Team roles and pre-read material
- 08
The Examination Session
How a facilitated session systematically walks each element and guide word to expose and record deviations.
- Facilitation and record-keeping discipline
- Working element by element, word by word
- Capturing causes, consequences, and safeguards live
- 09
HAZOP for Software, Signals & Data
Extending guide words to signals, messages, and data so software behaviour is examined as rigorously as physical flow.
- Guide words for signals, timing, and data
- Frozen, stale, corrupted, and out-of-order values
- Applying the method to CAN messages and interfaces
- 10
Worked Example - Value & Functional Deviations
A full HAZOP of electric power steering assist torque, exploring MORE, LESS, NO, and REVERSE assist deviations.
- Torque higher, lower, zero, or wrong sign
- Consequences from surprise steering to lost assist
- Safeguards and recommendations captured per row
- 11
Worked Example - Timing & Sequence Deviations
A HAZOP of an AEB decision chain where deviations are invisible to value checks but still cause collisions.
- EARLY, LATE, BEFORE, and AFTER braking
- A tight latency budget and its supervised window
- Correct values that arrive too late to help
- 12
Documentation, Follow-up & Integration
Turning worksheet findings into tracked actions and integrating them into the wider ISO 26262 safety lifecycle.
- Action tracking and close-out records
- Integration into HARA and downstream analyses
- Auditable traceability of every recommendation
- 13
Strengths, Limits & Method Comparison
Where HAZOP is strong on interaction hazards and how it compares with FMEA, FTA, and STPA.
- HAZOP versus FMEA, FTA, and STPA
- Strong on interaction and deviation hazards
- Knowing the method's blind spots
- 14
Pitfalls, Best Practices & Facilitation
The facilitation habits and common traps that separate a rigorous HAZOP from a box-ticking exercise.
- Avoiding checklist-style shortcuts
- Facilitation that keeps the team imaginative
- Best practices for coverage and closure
Not just text: the visual toolkit
Guide-Word Deviation Matrix
Maps each guide word against a parameter to generate the full grid of candidate deviations for an element.
Intention-to-Deviation Flow
Shows how a stated design intention is negated or distorted into a hazardous deviation.
Four-Phase Study Lifecycle
Traces a HAZOP from definition and preparation through examination to documentation and follow-up.
HAZOP-to-HARA Integration Map
Follows a worksheet deviation as it becomes a hazardous event, safety goal, and ASIL assignment.
EPS Torque Deviation Worksheet
Visualises the value and functional deviations of steering assist torque from the worked example.
AEB Timing Window Diagram
Illustrates how early and late braking decisions fall outside the supervised latency window.
Timing HAZOP of an Automatic Emergency Braking Decision Chain
Applying EARLY, LATE, BEFORE, and AFTER to an AEB decision chain reveals deviations that value checks cannot see: a brake command can be perfectly correct and still arrive too late to avoid the collision. Each deviation is measured against a tight latency budget and its supervised window before consequences and safeguards are recorded.
- LATE braking: correct decision arrives after the last point where the crash is avoidable
- EARLY braking: the system brakes hard for no target, risking a rear-end collision
- Sequence deviation: a target frame processed out of order corrupts the decision
- Timing deviations proven invisible to any value-based plausibility check
- Latency budget assessed against a supervised watchdog window
- Consequences, safeguards, and recommendations captured per worksheet row
Unlock the full AEB timing worksheet with causes, safeguards, and recommendations
Who this guide is for
- HARA facilitators who need a systematic way to identify hazardous events
- Systems engineers scoping hazards for a new E/E vehicle function
- Software and network engineers analyzing signal, timing, and data deviations
- Functional safety leads moderating cross-functional analysis workshops
Frequently Asked Questions
Common questions about HAZOP (Hazard and Operability Study) in ISO 26262
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required.